Small alignments of workflows across the 6 Java repos (#152)

Author: trask

.github/CODEOWNERS

@@ -1,5 +1,6 @@
-# Code owners file.
-# This file controls who is tagged for review for any given pull request.
+#
+# Learn about membership in OpenTelemetry community:
+#  https://github.com/open-telemetry/community/blob/main/guides/contributor/membership.md
+#
 
- # For anything not explicitly taken by someone else:
 * @open-telemetry/java-approvers @open-telemetry/java-instrumentation-maintainers

.github/workflows/build.yml

@@ -5,15 +5,14 @@ on:
     branches:
       - main
       - release/*
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
   build-and-publish-snapshots:
     runs-on: ubuntu-latest
-    # skipping release branches because the versions in those branches are not snapshots
-    if: github.ref_name == 'main' && github.repository == 'open-telemetry/opentelemetry-proto-java'
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
@@ -28,8 +27,12 @@ jobs:
 
       - name: Build
         run: ./gradlew build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Publish snapshots
+        # skipping release branches because the versions in those branches are not snapshots
+        if: github.ref_name == 'main' && github.repository == 'open-telemetry/opentelemetry-proto-java'
         run: ./gradlew publishToSonatype
         env:
           SONATYPE_USER: ${{ secrets.SONATYPE_USER }}

.github/workflows/gradle-wrapper-validation.yml

@@ -13,4 +13,5 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0

.github/workflows/ossf-scorecard.yml

@@ -8,7 +8,8 @@ on:
     - cron: "43 6 * * 5" # weekly at 06:43 (UTC) on Friday
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   analysis:

.github/workflows/prepare-release-branch.yml

@@ -20,7 +20,7 @@ jobs:
 
   create-pull-request-against-release-branch:
     permissions:
-      contents: write  # for Git to git push
+      contents: write  # for git push to PR branch
     runs-on: ubuntu-latest
     needs:
       - prereqs